Escape special characters using jquery to prevent js Injection

 

An error occurred while using ajax to leave a message. this is because after the message content is written, you can submit the content through ajax and add the message content to the page using js. when browsing the message, it is also requested through ajax and then displayed. in this way, if a js statement is written in the message, the conclusion will be executed. the solution is to escape these special characters and then display them. it is easy to use jstl labels in jsp. directly use <c: out value = "$ {r. content} "/> in this way, it will be automatically escaped. The parameter escapeXML =" true "is omitted, which is the default value. therefore, do not use el to express the content submitted by these users, because el does not automatically escape the content. It is better to use c: out. if the request is made through ajax and then displayed, use the following method. it's actually quite simple.

 

1: var html = "<script> alert ('asdfasdf ') <\/script> ";

2: $ ("# content "). text (html); then, the solution is simple: escape these special characters, that is, convert them to <> convert them to> escape the characters using jquery. This will allow you to 1:

4: html =$ ("# x" ).text(html#.html ();

5: $ ("# content"). append ("<div>" + html + "</div> ");

6: </script> 7: